Crypto-Ransomware : Your Crippling Information Technology Catastrophe
Ransomware Remediation ConsultantsCrypto-Ransomware has become a too-frequent cyberplague that represents an existential danger for businesses of all sizes unprepared for an attack. Different versions of ransomware such as Dharma, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for a long time and continue to cause harm. The latest variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, plus more unnamed newcomers, not only do encryption of online information but also infect all available system protection. Information synched to off-site disaster recovery sites can also be encrypted. In a vulnerable system, it can render automatic recovery hopeless and basically knocks the entire system back to square one.

Retrieving services and information after a crypto-ransomware outage becomes a sprint against time as the victim tries its best to contain the damage, cleanup the ransomware, and resume mission-critical activity. Since crypto-ransomware needs time to replicate, penetrations are usually launched on weekends, when penetrations are likely to take more time to recognize. This compounds the difficulty of promptly assembling and organizing a qualified response team.

Progent offers a variety of support services for protecting enterprises from ransomware attacks. These include team training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of modern security solutions with machine learning capabilities from SentinelOne to discover and disable new cyber attacks automatically. Progent in addition can provide the assistance of seasoned crypto-ransomware recovery professionals with the track record and commitment to re-deploy a compromised network as soon as possible.

Progent's Crypto-Ransomware Restoration Services
Following a ransomware invasion, sending the ransom in cryptocurrency does not provide any assurance that cyber criminals will return the needed codes to decipher all your files. Kaspersky Labs determined that 17% of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The other path is to setup from scratch the key elements of your Information Technology environment. Absent the availability of full data backups, this calls for a broad range of skills, top notch project management, and the ability to work continuously until the job is completed.

For twenty years, Progent has made available professional Information Technology services for companies across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have been awarded top industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in accounting and ERP software solutions. This breadth of expertise gives Progent the capability to rapidly identify necessary systems and organize the remaining parts of your computer network environment after a crypto-ransomware penetration and assemble them into a functioning network.

Progent's security group deploys powerful project management tools to orchestrate the complicated recovery process. Progent appreciates the urgency of acting quickly and in unison with a customer's management and IT team members to assign priority to tasks and to get critical services back on-line as soon as humanly possible.

Client Story: A Successful Crypto-Ransomware Incident Response
A business escalated to Progent after their organization was attacked by the Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean state cybercriminals, suspected of using approaches leaked from the U.S. NSA organization. Ryuk goes after specific businesses with limited room for disruption and is one of the most profitable examples of ransomware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturer based in Chicago and has around 500 workers. The Ryuk intrusion had shut down all essential operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the start of the attack and were encrypted. The client was taking steps for paying the ransom (exceeding $200K) and praying for the best, but ultimately brought in Progent.

"I cannot thank you enough in regards to the care Progent provided us during the most fearful time of (our) company's survival. We would have paid the Hackers if not for the confidence the Progent experts gave us. That you could get our e-mail system and critical applications back into operation in less than a week was earth shattering. Each person I talked with or communicated with at Progent was urgently focused on getting us operational and was working 24 by 7 to bail us out."

Progent worked together with the client to quickly assess and prioritize the critical elements that had to be restored in order to resume business operations:

  • Active Directory
  • Microsoft Exchange
  • MRP System
To get going, Progent followed ransomware incident mitigation industry best practices by halting lateral movement and performing virus removal steps. Progent then began the task of rebuilding Windows Active Directory, the key technology of enterprise systems built upon Microsoft Windows Server technology. Microsoft Exchange messaging will not operate without AD, and the customer's financials and MRP applications utilized SQL Server, which requires Windows AD for authentication to the data.

In less than 2 days, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then helped perform rebuilding and storage recovery on the most important servers. All Microsoft Exchange Server ties and configuration information were intact, which accelerated the restore of Exchange. Progent was also able to locate local OST files (Outlook Offline Data Files) on various PCs to recover mail data. A not too old off-line backup of the businesses accounting/ERP software made them able to recover these essential services back servicing users. Although a lot of work needed to be completed to recover fully from the Ryuk attack, the most important services were returned to operations rapidly:

"For the most part, the manufacturing operation ran fairly normal throughout and we delivered all customer deliverables."

During the following few weeks critical milestones in the recovery project were achieved in tight cooperation between Progent engineers and the customer:

  • In-house web sites were brought back up without losing any data.
  • The MailStore Server exceeding 4 million historical messages was restored to operations and accessible to users.
  • CRM/Customer Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory Control functions were 100% recovered.
  • A new Palo Alto 850 security appliance was set up.
  • Nearly all of the desktops and laptops were operational.
"A huge amount of what occurred those first few days is nearly entirely a haze for me, but we will not soon forget the urgency all of your team put in to give us our business back. I have utilized Progent for at least 10 years, possibly more, and every time Progent has come through and delivered. This event was a testament to your capabilities."

Conclusion
A potential enterprise-killing catastrophe was avoided through the efforts of top-tier professionals, a wide range of IT skills, and close teamwork. Although in analyzing the event afterwards the crypto-ransomware virus attack described here would have been blocked with current cyber security technology solutions and best practices, user and IT administrator education, and well thought out incident response procedures for backup and proper patching controls, the reality remains that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware incursion, remember that Progent's roster of experts has substantial experience in ransomware virus blocking, mitigation, and data recovery.

"So, to Darrin, Matt, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (and any others that were contributing), I'm grateful for allowing me to get rested after we got over the initial fire. All of you did an incredible effort, and if any of your team is around the Chicago area, a great meal is my treat!"

To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Allentown a range of online monitoring and security evaluation services designed to assist you to reduce the threat from ransomware. These services utilize next-generation machine learning technology to uncover new variants of ransomware that are able to escape detection by legacy signature-based anti-virus solutions.

  • ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
    ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management (RMM) techniques to help keep your network running efficiently by tracking the state of critical assets that drive your information system. When ProSight LAN Watch detects an issue, an alert is transmitted automatically to your specified IT management staff and your assigned Progent engineering consultant so any potential issues can be addressed before they can impact your network. Find out more details about ProSight LAN Watch server and desktop monitoring services.

  • ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
    ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven solution for managing your network, server, and desktop devices by offering tools for performing common time-consuming jobs. These can include health monitoring, patch management, automated remediation, endpoint configuration, backup and restore, A/V defense, remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alert to your specified IT management personnel and your assigned Progent consultant so that emerging issues can be taken care of before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

  • ProSight WAN Watch: Network Infrastructure Management
    ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized businesses to diagram, track, enhance and debug their connectivity hardware like switches, firewalls, and load balancers plus servers, client computers and other devices. Using state-of-the-art RMM technology, ProSight WAN Watch ensures that network maps are kept updated, captures and displays the configuration of almost all devices on your network, tracks performance, and generates notices when issues are detected. By automating time-consuming management and troubleshooting processes, WAN Watch can cut hours off common chores like making network diagrams, reconfiguring your network, locating devices that require important updates, or resolving performance issues. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

  • ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
    ProSight Reporting is a growing line of real-time and in-depth management reporting utilities designed to work with the top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

  • ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
    Progent has partnered with leading backup technology companies to create ProSight Data Protection Services (DPS), a portfolio of offerings that deliver backup-as-a-service (BaaS). ProSight DPS products automate and monitor your data backup processes and enable non-disruptive backup and rapid recovery of vital files, apps, images, and VMs. ProSight DPS helps your business protect against data loss caused by equipment breakdown, natural disasters, fire, cyber attacks like ransomware, human error, malicious insiders, or application glitches. Managed backup services in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these managed backup services are best suited for your IT environment.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of leading data security vendors to deliver centralized control and comprehensive protection for all your email traffic. The powerful architecture of Email Guard combines cloud-based filtering with an on-premises security gateway appliance to offer complete defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based malware. Email Guard's cloud filter acts as a first line of defense and blocks the vast majority of threats from making it to your security perimeter. This reduces your vulnerability to external attacks and conserves system bandwidth and storage. Email Guard's on-premises gateway device adds a deeper layer of inspection for incoming email. For outbound email, the onsite security gateway provides AV and anti-spam protection, DLP, and email encryption. The onsite security gateway can also assist Exchange Server to track and safeguard internal email that originates and ends within your corporate firewall. For more details, see ProSight Email Guard spam filtering and data leakage protection.

  • ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on (SSO)
    Progent's Duo authentication services utilize Cisco's Duo technology to defend against stolen passwords by using two-factor authentication (2FA). Duo enables one-tap identity verification with iOS, Android, and other personal devices. With Duo 2FA, when you sign into a protected application and enter your password you are asked to confirm your identity on a device that only you have and that uses a separate network channel. A broad selection of out-of-band devices can be used for this added form of authentication such as an iPhone or Android or wearable, a hardware/software token, a landline phone, etc. You may register multiple verification devices. To learn more about ProSight Duo identity validation services, see Cisco Duo MFA two-factor authentication (2FA) services.

  • Progent's Outsourced/Shared Call Center: Call Center Managed Services
    Progent's Call Center managed services permit your information technology group to offload Support Desk services to Progent or split activity for Help Desk services transparently between your in-house support staff and Progent's extensive roster of IT service engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a seamless extension of your core IT support team. Client interaction with the Help Desk, delivery of support services, problem escalation, trouble ticket creation and updates, efficiency measurement, and maintenance of the service database are consistent whether issues are taken care of by your core IT support staff, by Progent, or a mix of the two. Find out more about Progent's outsourced/shared Call Desk services.

  • Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
    Progent's Active Defense Against Ransomware is an endpoint protection managed service that utilizes next generation behavior-based machine learning technology to defend endpoints as well as physical and virtual servers against modern malware attacks such as ransomware and email phishing, which routinely get by legacy signature-matching AV tools. Progent Active Security Monitoring services safeguard on-premises and cloud resources and provides a single platform to manage the entire threat lifecycle including blocking, identification, containment, cleanup, and post-attack forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against new attacks. Learn more about Progent's ransomware defense and cleanup services.

  • ProSight IT Asset Management: Network Documentation Management
    ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, find and protect data about your network infrastructure, procedures, business apps, and services. You can instantly locate passwords or IP addresses and be warned automatically about impending expirations of SSLs or domains. By updating and managing your network documentation, you can eliminate as much as half of time thrown away searching for critical information about your IT network. ProSight IT Asset Management includes a common repository for holding and sharing all documents required for managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also supports advanced automation for collecting and associating IT information. Whether you're planning enhancements, performing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you require as soon as you need it. Read more about ProSight IT Asset Management service.

  • Patch Management: Software/Firmware Update Management Services
    Progent's managed services for software and firmware patch management provide organizations of all sizes a flexible and cost-effective solution for evaluating, testing, scheduling, implementing, and tracking software and firmware updates to your dynamic information network. In addition to optimizing the protection and functionality of your IT environment, Progent's software/firmware update management services permit your IT staff to focus on line-of-business initiatives and tasks that deliver the highest business value from your information network. Learn more about Progent's patch management services.

  • ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
    With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected fault tolerant data center on a high-performance virtual host set up and managed by Progent's network support experts. Under Progent's ProSight Virtual Hosting service model, the client retains ownership of the data, the operating system software, and the apps. Because the environment is virtualized, it can be ported immediately to a different hardware solution without requiring a lengthy and difficult configuration process. With ProSight Virtual Hosting, your business is not tied a single hosting service. Learn more about ProSight Virtual Hosting services.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that utilizes SentinelOne's cutting edge behavior machine learning tools to guard physical and virtual endpoint devices against new malware attacks such as ransomware and file-less exploits, which routinely evade legacy signature-matching AV tools. ProSight ASM safeguards on-premises and cloud-based resources and offers a unified platform to manage the complete malware attack lifecycle including protection, identification, containment, remediation, and post-attack forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

  • ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Microsoft Exchange Email Filtering
    Progent's ProSight Enhanced Security Protection managed services deliver affordable in-depth protection for physical servers and VMs, workstations, smartphones, and Exchange Server. ProSight ESP utilizes adaptive security and advanced heuristics for continuously monitoring and reacting to security threats from all vectors. ProSight ESP provides firewall protection, penetration alerts, device control, and web filtering via cutting-edge technologies packaged within a single agent accessible from a single control. Progent's security and virtualization consultants can assist your business to design and configure a ProSight ESP environment that meets your organization's specific requirements and that allows you prove compliance with government and industry information security standards. Progent will help you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that require urgent action. Progent's consultants can also help you to install and test a backup and disaster recovery system like ProSight Data Protection Services so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange email filtering.
For Allentown 24-Hour Crypto Recovery Consulting, contact Progent at 800-462-8800 or go to Contact Progent.